selinux: constify source policy in cond_policydb_dup()

cond_policydb_dup() duplicates conditional parts of an existing policy.
Declare the source policy const, since it should not be modified.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
[PM: various line length fixups]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index e868fc403d753cbd1fc31b110de60379f92d2c18..64ba95e40a6fe4ffe36ba45dc6c80104176bcf72 100644 (file)
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -603,7 +603,8 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
        }
 }
 
-static int cond_dup_av_list(struct cond_av_list *new, struct cond_av_list *orig,
+static int cond_dup_av_list(struct cond_av_list *new,
+                           const struct cond_av_list *orig,
                            struct avtab *avtab)
 {
        u32 i;
@@ -626,7 +627,7 @@ static int cond_dup_av_list(struct cond_av_list *new, struct cond_av_list *orig,
 }
 
 static int duplicate_policydb_cond_list(struct policydb *newp,
-                                       struct policydb *origp)
+                                       const struct policydb *origp)
 {
        int rc;
        u32 i;
@@ -643,7 +644,7 @@ static int duplicate_policydb_cond_list(struct policydb *newp,
 
        for (i = 0; i < origp->cond_list_len; i++) {
                struct cond_node *newn = &newp->cond_list[i];
-               struct cond_node *orign = &origp->cond_list[i];
+               const struct cond_node *orign = &origp->cond_list[i];
 
                newp->cond_list_len++;
 
@@ -683,8 +684,8 @@ static int cond_bools_destroy(void *key, void *datum, void *args)
        return 0;
 }
 
-static int cond_bools_copy(struct hashtab_node *new, struct hashtab_node *orig,
-                          void *args)
+static int cond_bools_copy(struct hashtab_node *new,
+                          const struct hashtab_node *orig, void *args)
 {
        struct cond_bool_datum *datum;
 
@@ -710,7 +711,7 @@ static int cond_bools_index(void *key, void *datum, void *args)
 }
 
 static int duplicate_policydb_bools(struct policydb *newdb,
-                                   struct policydb *orig)
+                                   const struct policydb *orig)
 {
        struct cond_bool_datum **cond_bool_array;
        int rc;
@@ -743,7 +744,7 @@ void cond_policydb_destroy_dup(struct policydb *p)
        cond_policydb_destroy(p);
 }
 
-int cond_policydb_dup(struct policydb *new, struct policydb *orig)
+int cond_policydb_dup(struct policydb *new, const struct policydb *orig)
 {
        cond_policydb_init(new);
 

diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h
index b972ce40db188cc5d7b9d078f7794b7da321d78d..8827715bad751b344870017374867be7d41bc35e 100644 (file)
--- a/security/selinux/ss/conditional.h
+++ b/security/selinux/ss/conditional.h
@@ -79,6 +79,6 @@ void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
                         struct extended_perms_decision *xpermd);
 void evaluate_cond_nodes(struct policydb *p);
 void cond_policydb_destroy_dup(struct policydb *p);
-int cond_policydb_dup(struct policydb *new, struct policydb *orig);
+int cond_policydb_dup(struct policydb *new, const struct policydb *orig);
 
 #endif /* _CONDITIONAL_H_ */

diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c
index 754bedbde133cf8399ce4fc278306894bc32c88b..32c4cb37f3d2fd4fe7c25cb4d446aa4284eec9d7 100644 (file)
--- a/security/selinux/ss/hashtab.c
+++ b/security/selinux/ss/hashtab.c
@@ -136,11 +136,12 @@ void hashtab_stat(struct hashtab *h, struct hashtab_info *info)
 }
 #endif /* CONFIG_SECURITY_SELINUX_DEBUG */
 
-int hashtab_duplicate(struct hashtab *new, struct hashtab *orig,
+int hashtab_duplicate(struct hashtab *new, const struct hashtab *orig,
                      int (*copy)(struct hashtab_node *new,
-                                 struct hashtab_node *orig, void *args),
+                                 const struct hashtab_node *orig, void *args),
                      int (*destroy)(void *k, void *d, void *args), void *args)
 {
+       const struct hashtab_node *orig_cur;
        struct hashtab_node *cur, *tmp, *tail;
        u32 i;
        int rc;
@@ -155,12 +156,13 @@ int hashtab_duplicate(struct hashtab *new, struct hashtab *orig,
 
        for (i = 0; i < orig->size; i++) {
                tail = NULL;
-               for (cur = orig->htable[i]; cur; cur = cur->next) {
+               for (orig_cur = orig->htable[i]; orig_cur;
+                    orig_cur = orig_cur->next) {
                        tmp = kmem_cache_zalloc(hashtab_node_cachep,
                                                GFP_KERNEL);
                        if (!tmp)
                                goto error;
-                       rc = copy(tmp, cur, args);
+                       rc = copy(tmp, orig_cur, args);
                        if (rc) {
                                kmem_cache_free(hashtab_node_cachep, tmp);
                                goto error;

diff --git a/security/selinux/ss/hashtab.h b/security/selinux/ss/hashtab.h
index 5f74dcc1360fef913067d99d6afad4d1d9547a5c..deba82d78c3aebec20a98f74e4f3371fb3161a70 100644 (file)
--- a/security/selinux/ss/hashtab.h
+++ b/security/selinux/ss/hashtab.h
@@ -136,9 +136,9 @@ void hashtab_destroy(struct hashtab *h);
 int hashtab_map(struct hashtab *h, int (*apply)(void *k, void *d, void *args),
                void *args);
 
-int hashtab_duplicate(struct hashtab *new, struct hashtab *orig,
+int hashtab_duplicate(struct hashtab *new, const struct hashtab *orig,
                      int (*copy)(struct hashtab_node *new,
-                                 struct hashtab_node *orig, void *args),
+                                 const struct hashtab_node *orig, void *args),
                      int (*destroy)(void *k, void *d, void *args), void *args);
 
 #ifdef CONFIG_SECURITY_SELINUX_DEBUG